Summarize an SBOM — summary.sbom • sbom

Counts the components of an SBOM by ecosystem, type and evidence, tallies their licenses, collects the drift issues, and counts the advisories.

Usage

# S3 method for class 'sbom'
summary(object, ...)

# S3 method for class 'sbom_summary'
print(x, ...)

Arguments

object: An <sbom> object, as returned by sbom_package() or sbom_installed().
...: Ignored.
x: An <sbom_summary> object.

Value

summary() returns an <sbom_summary>, a list with counts (a data frame with columns what, value and n, for "ecosystem", "type" and "evidence"), licenses (columns license and n, most common first), unknowns (the number of unknown components), drift (the issues whose code starts with "drift-") and advisories (a list of status, "listed", "not-requested" or "unavailable", and n, the number of advisories listed). print() returns x invisibly.

Details

Every component is counted, including the root, R, base packages and files. A component is unknown when its version is NA or its SPDX license is NA (reported as "NOASSERTION"). Base packages have no version, so they are always unknown.

Examples

x <- sbom_package(system.file("DESCRIPTION", package = "sbom"), system = FALSE)
summary(x)
#> sbom 0.1.0
#> Advisories: not requested.
#> 
#> ── Components ──
#> 
#> ecosystem: repository (15), base-r (2), local (1), r (1)
#> type: library (18), platform (1)
#> evidence: observed (18), declared (1)
#> Unknown version or license: 2
#> 
#> ── Licenses ──
#> 
#> MIT (12), GPL-2.0-only OR GPL-3.0-only (3), NOASSERTION (2), BSD-3-Clause (1),
#> GPL-3.0-only (1)
#> 
#> ── Drift ──
#> 
#> No drift.